This vulnerability (CVE-2026-40952) involves a privilege misconfiguration in the Secure Access installer for Windows client and server versions before 14.55. When Secure Access is installed in a non-default directory, local attackers can leverage this misconfiguration to escalate their privileges to Administrator level. The CVSS 4.0 vector indicates local attack vector with low attack complexity, no user interaction required, and high impact on confidentiality, integrity, and availability. The vulnerability is classified under CWE-276 (Incorrect Default Permissions). No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

Successful exploitation allows a local attacker to elevate their privileges to Administrator on the affected system, potentially leading to full system compromise. This can undermine system security by granting unauthorized administrative control, affecting confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid installing Secure Access in non-default locations and restrict local access to trusted users only.